CVE-2026-81634

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.27.0

Description A heap buffer overflow can occur during the RRSet canonicalisation routine when processing a 255 length query name with a large TCP response. This issue stems from a failure to include the first owner name in the buffer length check. An attacker controlling a malicious name server or manipulating an incoming response can trigger this condition, as canonicalisation occurs before DNSSEC validation.

Recommendations Update NLnet Labs Unbound to a version later than 1.26.0.